A plain-English guide to dialer compliance with VICIdial

Compliance is mostly a configuration problem. Outbound calling in the USA is governed by a stack of rules from the FTC, the FCC, the TCPA and a growing pile of state laws, and almost every one of those rules maps onto a specific VICIdial campaign field. Set the fields correctly and you have done most of the technical work. Here is the whole landscape in plain English, with the exact setting that helps you stay on the right side of each rule.

One thing up front. Nothing here is legal advice. The point is to show how VICIdial helps you implement decisions you and your lawyer have already made. When in doubt about whether a rule applies to your business, talk to an attorney who specializes in telecom law.

The FTC Telemarketing Sales Rule

The Federal Trade Commission launched the federal Do-Not-Call list in 2003 and bundled a set of restrictions on outbound sales calling into the Telemarketing Sales Rule, or TSR. A 2008 update changed the dropped-call calculation to a 30-day window, and a 2024 update expanded several provisions to cover some business-to-business calls and tightened record-keeping. If you call US consumers to sell something, the TSR is your starting point. We break the whole rule down in our guide to the FTC Telemarketing Sales Rule.

The federal Do-Not-Call list

The federal DNC (do not call) list is an opt-in registry maintained by the FTC with hundreds of millions of numbers in it. If you place sales calls to consumers, you must scrub your calling lists against the National DNC Registry at least once a month, and the fines for getting it wrong run into thousands of dollars per call. To get the list you register with the FTC as a Seller company, and the full national list is not cheap. It is also illegal to share your list or filter other companies' leads through your account.

**Heads up:** do not try to load the entire federal DNC list into VICIdial. The internal DNC feature is meant for the people who personally ask you to stop calling, not for a two-hundred-million-row national registry. Stuff the whole list in and the system stops working properly. Scrub your leads before you import them. We walk through the right approach in how to filter leads against the federal DNC.

Safe Harbor: five provisions, five fields

FTC Safe Harbor is the set of conditions that let you use automated dialing equipment to call consumers at all. There are five provisions, and each lines up with a VICIdial campaign setting. Get all five right and your predictive dialing rests on solid ground. The deep dive lives in what is FTC Safe Harbor.

Provision one is the abandonment limit. A live answer must reach an agent within two seconds of the consumer finishing their greeting, and across a campaign you cannot abandon more than three percent of answered calls over any 30-day period. In VICIdial the relevant field is Drop Call Seconds, and a value of 5 gives roughly three seconds for the greeting plus a two-second wait before the system counts the call as a drop. The math behind that ceiling is covered in the 3 percent abandonment rule, and the field walk-through is in how to set Drop Call Seconds for Safe Harbor. Keeping your Abandonment rate under that line is the single most-watched number in predictive dialing.

Provision two is the abandoned-call message. When a call does drop, you have to play a recording that names your company, says why you called, and gives a callback number. Set the Drop Action campaign field to MESSAGE and point the Safe Harbor Exten field at the extension that holds your Safe Harbor message. Setup details are in how to set up the Safe Harbor message.

Provision three is your own internal do-not-call list. Anyone who asks you to stop calling has to go on a company-specific list. Set Use Internal DNC List to Y on the campaign and VICIdial honours it automatically.

Provision four is ring time. A call has to ring for at least 15 seconds, or four rings, before you hang up. The Dial Timeout campaign field controls this, so set it higher than 15 seconds per campaign.

Provision five is record-keeping. You must keep calling records for up to five years and produce them on request, and the 2024 update added pre-recorded messages, carrier details and DNC compliance logs to that list. VICIdial keeps a lot of this in the database by default, and the optional cold-storage feature moves older archived logs onto a separate database server while keeping them searchable. The retention story is in Safe Harbor record-keeping for five years.

How a call gets checked

It helps to picture the gates a call passes through before and after it connects. The lead is scrubbed before it ever enters the system, the campaign clock and caller ID are applied as the call goes out, and the abandonment logic decides what happens when nobody answers in time.

flowchart TD
  A[Lead pre-scrubbed against DNC and cell lists] --> B[Loaded into VICIdial]
  B --> C{Inside Local Call Time}
  C -->|No| D[Hold until allowed hours]
  C -->|Yes| E[Dial with Campaign Caller ID]
  E --> F{Answered}
  F -->|No| G[Ring at least Dial Timeout seconds]
  F -->|Yes| H{Agent ready in Drop Call Seconds}
  H -->|Yes| I[Connect to agent]
  H -->|No| J[Drop Action MESSAGE plays Safe Harbor Exten]
  J --> K[Counted toward 3 percent abandonment]

Caller ID and calling times

Every outbound sales call has to send a working caller ID that identifies your company and lets the consumer ask not to be called again. The Campaign Caller ID field on the Campaign Detail screen sets the number for that campaign.

The FTC also bars calls before 8AM or after 9PM local time, and many states are stricter. A safe default is a 9AM to 9PM window. Set the campaign-wide window in the Local Call Time field and refine day-of-week and state-specific limits through the Call times section of the admin interface. The rule and its edge cases are in the FTC local calling time rule.

The TCPA, cell phones and consent

The Telephone Consumer Protection Act of 1991 sits alongside the FTC rules and is enforced by the FCC. The headline restriction is that calling cell phones with an automatic telephone dialing system, an ATDS, requires prior express written consent. We unpack the whole framework in what is the TCPA for call centers.

You have two clean paths to stay inside the TCPA. The first is to call cell phones only from a dialer with no auto-dial capacity, which means a manual-dial-only configuration where every call needs human intervention. The second is to collect proper consent: a written agreement naming the caller and the number, stating the purpose is telemarketing, disclosing that an ATDS may be used, noting that consent is not a condition of purchase, and capturing an affirmative action such as a signature. Recorded verbal consent can qualify under the ESIGN Act with the right wording. The full checklist is in what is express written consent, and Express written consent is worth getting exactly right because the penalties are steep.

**Gotcha:** with number portability there is no perfectly accurate way to know which numbers are cell phones. The practical answer is a daily fee-based filtering service that scrubs your leads before import, which counts as a best-effort solution. VICIdial integrates with on-site daily cell-phone filtering so the system can pull batch files nightly and scrub the whole system or specific lists. The mechanics are in how to filter cell phones from leads.

A pair of Supreme Court rulings narrowed what counts as an ATDS, and the 2021 unanimous decision defined it as equipment that stores or produces numbers using a random or sequential number generator. Since VICIdial does not generate or produce numbers that way, it falls outside that definition. The 2025 FCC changes still matter: lead-provider consent must now be per-business, revocation can be made in any reasonable manner and processed within ten days, and AI voice bots are treated like pre-recorded calls.

STIR/SHAKEN and the TRACED Act

The TRACED Act became law in 2019 to fight caller ID spoofing, and its two big tools are STIR/SHAKEN call signing and carrier-level robocall mitigation. STIR/SHAKEN lets carriers cryptographically sign calls so the origin can be validated end to end, with four attestation levels from A (full attestation) down to no attestation. The background is in what is STIR/SHAKEN, and the TRACED Act itself is covered in what is the TRACED Act.

Robocall mitigation is the looser, carrier-defined side of this. Some carriers block calls with low attestation outright, and some flag numbers that place too many calls to a single subscriber as SCAM LIKELY, with thresholds that vary wildly. Legitimate callers like pharmacies and appointment reminders get caught all the time, and there is rarely an easy way to clear a flag. As of June 2025 every VoIP service provider must hold its own STIR/SHAKEN certificate for calls originating on its network. VICIdial includes code for the TILTX STIR/SHAKEN API so you can integrate with carrier signing requirements.

State mini-TCPAs and recording consent

States layer their own rules on top of the federal ones. Many have stricter calling windows, telemarketing-prohibited holidays, and separate state DNC lists that do not always feed the federal registry, so filtering federally is not enough on its own. Most of the tighter state calling windows already ship inside VICIdial and just need activating in your campaign's selected call time scheme.

A growing group of states have passed mini-TCPAs modelled on Florida's 2021 law: an 8AM to 8PM window, a limit of three call attempts to one number in any 24-hour period, and express-consent requirements. Maryland, Oklahoma, Oregon and Washington have followed with their own variations, including Washington's rule that you must end a call within ten seconds if the consumer asks. VICIdial added a dedicated 24-Hour Call Count Limit feature because the unusual 24-hour wording could not be handled by the existing daily limits. Start with what is a mini-TCPA.

Recording is its own minefield. Federal law needs only one-party notice, but twelve states require that all parties be told the call is recorded. VICIdial does not restrict recording by state, so the safe options are not recording, playing a recorded notice, or having agents announce it. The state-by-state split and Two-party consent rules are in one-party vs two-party recording consent.

Pricing and a path forward

All of this is a lot easier when the dialer ships ready to be configured for it rather than fighting you. If you want a hosted VICIdial setup where these fields are within reach from day one, you can see VICIfast pricing and pick a plan that fits the size of your operation.

Calling outside the USA

If your calls cross borders, the rules change again. In the UK, OFCOM mirrors much of the US framework but adds a 72-hour lockout on re-attempting a dropped call, which maps to the Drop Lockout Time field, and lets you calculate drop rate across all campaigns through the Multiple Campaign Drop Rate Group option. There are also the TPS and CTPS preference lists to scrub against. The details are in UK call center regulations.

Canada's CRTC (Canada) rules took effect in 2008, modelled on the FTC TSR, with its own DNCL, a six-month window for information requests, immediate disclosure of who you are calling for, a three-year-and-31-day internal DNC retention rule, and tighter calling windows of 9AM to 9:30PM on weekdays and 10AM to 6PM on weekends. See Canada CRTC regulations.

And if you touch data on EU residents, GDPR applies even when your business sits outside the EU. It gives people a right of access to their data and a right to erasure, and VICIdial added settings to download or fully delete a lead's data, including recordings, from the Modify Lead page. The overview is in what is GDPR for call centers.

Putting it together

Compliance is not one switch. It is the federal DNC scrub before import, the five Safe Harbor fields, the caller ID and calling-time settings, cell-phone filtering and consent for the TCPA, STIR/SHAKEN signing with your carrier, the state-specific call times and 24-hour limits, recording notices where two-party consent applies, and the overseas settings if you call abroad. Configure each one deliberately, keep your records, and review the rules with counsel as they change. VICIdial gives you a field for nearly every requirement, which is most of the battle.

When you are ready to stand up a dialer that has all of these knobs in one place, see VICIfast pricing to get started.